Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
  • G06F12/02—Addressing or allocation; Relocation
  • G06F12/08—Addressing or allocation; Relocation in hierarchically structured memory systems, e.g. virtual memory systems
  • G06F12/10—Address translation
  • G06F12/1081—Address translation for peripheral access to main memory, e.g. direct memory access [DMA]
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
  • G06F12/14—Protection against unauthorised use of memory or access to memory
  • G06F12/1408—Protection against unauthorised use of memory or access to memory by using cryptography
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
  • G06F12/14—Protection against unauthorised use of memory or access to memory
  • G06F12/1458—Protection against unauthorised use of memory or access to memory by checking the subject access rights
  • G06F12/1466—Key-lock mechanism
  • G06F12/1475—Key-lock mechanism in a virtual system, e.g. with translation means
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
  • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
  • G06F21/79—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in semiconductor storage media, e.g. directly-addressable memories
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
  • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/16—Implementing security features at a particular protocol layer
  • H04L63/164—Implementing security features at a particular protocol layer at the network layer
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
  • G06F2212/10—Providing a specific technical effect
  • G06F2212/1052—Security improvement

Definitions

• This specification relates to validating memory access requests.
• GPUs Graphics processing units
• CPU central processing unit
• DRAM dynamic random-access memory
• NICs network interface cards
• SSDs solid state drives
• PCI Peripheral component interconnect
• ATS allows a device to request an address translation from an input/output memory management unit (IOMMU) and cache the translation locally on the device. Subsequent accesses to the translated range by the device can be marked as already translated and bypass the IOMMU.
• IOMMU input/output memory management unit
• a memory management unit receives address translation requests from a device, e.g., connected to a motherboard, and generates a signature for each requested physical address.
• the memory management unit provides the signature to the device and, when receiving memory access requests from the device, uses the corresponding signature to validate the memory location being accessed, validate the device sending the request, or both.
• one innovative aspect of the subject matter described in this specification can be embodied in methods that include the actions of receiving, by a component from a device, a plurality of first requests, each of the plurality of first requests for a corresponding physical address and including a corresponding virtual address, for each of the plurality of first requests determining, by the component, a first physical address using the corresponding virtual address, generating a first signature for the first physical address, the first signature for use to validate the first physical address, and providing, to the device, a response that includes the first signature, receiving, from the device, a plurality of second requests, each of the plurality of second requests for access to a corresponding second physical address and including a corresponding second signature, determining, by the component for each of the plurality of second requests, whether the corresponding second physical address is valid using the corresponding second signature, and for each second request for which the second physical address is determined to be valid using the second signature of the corresponding second request, servicing the corresponding second request.
• inventions of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.
• a system of one or more computers can be configured to perform particular operations or actions by virtue of having software, firmware, hardware, or a combination of them installed on the system that in operation causes or cause the system to perform the actions.
• One or more computer programs can be configured to perform particular operations or actions by virtue of including instructions that, when executed by data processing apparatus, cause the apparatus to perform the actions.
• the method may include for each second request for which the second physical address is determined to be not valid using the second signature of the corresponding second request, not servicing the corresponding second request. Not servicing, for a second, different subset of the plurality of second requests, the second request may include denying, for each of the second requests in the second subset, the respective second request. Not servicing, for a second, different subset of the plurality of second requests, the second request may include logging, for each of the second requests in the second subset, a corresponding error indicating the respective second request.
• the second request may include resetting or halting the device.
• Not servicing the corresponding second request for each second request for which the second physical address is determined to be not valid using the second signature of the corresponding second request may include changing a secret value for the device.
• Not servicing the corresponding second request for each second request for which the second physical address is determined to be not valid using the second signature of the corresponding second request may include disabling the device's access to a memory.
• the method may include servicing at least one of the plurality of second requests, and not servicing at least another one of the plurality of second requests.
• the method includes receiving a particular request from the device, determining whether the particular request includes a virtual address, and determining whether the particular request is i) one of the plurality of first requests in response to determining that the particular request includes a virtual address or ii) one of the plurality of second requests in response to determining that the particular request does not include a virtual address.
• Each of the plurality of first requests may include the corresponding virtual address, and an identifier for the device.
• Generating, for each of the plurality of first requests, the first signature for the first physical address may include determining a secret value using the identifier, generating a hash value using the first physical address and the secret value, and generating the first signature using at least a portion of the hash value.
• providing, to the device for each of the plurality of first requests, the response that includes the first signature includes concatenating the first signature and the first physical address, and providing a response that includes the first signature concatenated with the first physical address in a single field of the response.
• the identifier for the device may include a device bus number for the device.
• Each of the plurality of second requests may include the corresponding second physical address, the corresponding second signature, and the identifier for the device.
• Determining, by the component for each of the plurality of second requests, whether the corresponding second physical address is valid using the corresponding second signature may include determining the secret value using the identifier, generating a hash value using the corresponding second physical address and the secret value, generating a third signature using at least a portion of the hash value, determining whether the
• corresponding second signature and the third signature are the same, and determining that the corresponding second physical address is valid in response to determining that the corresponding second signature and the third signature are the same.
• generating, for each of the plurality of first requests, the first signature using at least a portion of the hash value includes generating the first signature using a predetermined quantity of least significant bits from the hash value.
• Generating, for each of the plurality of first requests, the first signature using at least a portion of the hash value may include generating the first signature using all of the hash value.
• Generating the hash value by encrypting the first physical address using the secret value may include determining a cipher text and an authentication tag encrypting the first physical address using the secret value as input to a Galois Message
• GMAC Authentication Code
• the method may include determining at least one permission value for the device using the identifier.
• Generating the hash value by encrypting the first physical address using the secret value may include determining the hash value by encrypting the first physical address using the at least one permission value.
• the at least one permission value may include at least one of a read permission bit, a write permission bit, an execute permission bit, a cacheability bit, a cache level hint bit, a transaction class, or a virtual channel number.
• each of the plurality of second requests includes an identifier for the device.
• receiving, from the device, the plurality of second requests includes receiving, by a switch chip from the device for each of the plurality of second requests, the corresponding second request, determining, by the switch chip for each of the plurality of second requests, that the corresponding second request includes an unknown address, and sending, by the switch chip for each of the plurality of second requests, the corresponding second request to the component.
• providing, to the device for each of the plurality of first requests, the response that includes the first signature includes generating, for each of the plurality of first requests, the response using the first signature in an error-detecting code field and the first physical address in a body of the response.
• Generating, for each of the plurality of first requests, the response using the first signature in the error- detecting code field and the first physical address in the body of the response may include generating an error-detecting code value using the first signature and content from the response other than content from the error-detecting code field, and using the error- detecting code value in the error-detecting code field of the response.
• servicing, for at least one second request, the corresponding second request includes determining that the second request includes a read request, providing, by the component, a read request to a second device that is associated with the corresponding second physical address, the read request including the corresponding second signature, receiving, from the second device, a second response to the read request, the second response including a destination address and a signature, and determining whether the destination address is valid using the signature.
• the method may include for each of the at least one second request for which the destination address is determined to be valid using the signature, providing content from the second response to the device, and for each of the at least one second request for which the destination address is determined to be not valid using the signature, discarding the second response.
• the method may include providing content from the second response to the device for one of the at least one second request, and discarding the second response for another one of the at least one second request.
• the systems and methods described below may prevent a device from accessing a physical address outside an approved range for the device, e.g., for devices that perform their own address translation or when the system verifies addresses only at translation time. For instance, a system may verify that a device should be allowed access to an address whenever the device requests access to the address.
• the systems and methods described below may prevent malicious or erroneous software or hardware of a device from exploiting intentional or accidental flaws in the device to access memory outside of a range the system intended for the device to be permitted to access, e.g., when a device builder is unable to verify that the device silicon matches a design for the device.
• the systems and methods described below may prevent brute force guessing of signatures because well- behaved devices never emit invalid addresses and the system may halt, reset, or both, a device the first time that device provides the system with an invalid address.
• the systems and methods described below may allow the system to validate a device's memory access request without accessing a mapping of valid addresses for the device for each request by relying on the storage of the address, a signature for the address, or both, in the device without relying on the device to be trusted to generate only valid addresses.
• the systems and methods described below may require less memory storage space based on the number of secret values required compared to other systems, e.g., with translation lookaside buffers.
• the systems and methods described below may help limit the number of components in a system that need to be trusted, e.g., to a central processing unit (CPU) and the components on the same chip as the CPU, may be implemented without changes to existing hardware or all existing hardware, or both.
• a component may use multiple keys for a single device, an index, or both, to remove the device's access to some memory locations but not all memory locations to which the device previously had access.
• FIG. 1 is an example of an environment in which a memory management unit generates and provides signatures for physical addresses to multiple devices.
• FIG. 2 is a flow diagram of a process for processing requests.
• FIG. 3 is a block diagram of a computing system that can be used in connection with computer-implemented methods described in this document.
• an input/output memory management unit may be any input/output memory management unit.
• IOMMU peripheral component interconnect
• PCIe peripheral component interconnect express
• the IOMMU may use the signature to prevent the device from spoofing any other physical addresses or replaying invalidated addresses, e.g., for accessing memory outside of a permitted range for the device.
• the IOMMU may encode the signature, e.g., cryptographic signature, in the address or another field of a packet, e.g., a PCI express (PCIe) packet, provided to the device.
• PCIe PCI express
• a device may receive a translated address from a memory management unit (MMU) which the MMU determines using PCI standard device address translation or MMU device driver address map operations that populate in-device page table entries.
• MMU memory management unit
• the MMU may invoke MMU driver code to allocate a device virtual address that is unique per device, and create MMU page table mappings translating that virtual address to the specified central processing unit (CPU) physical address.
• CPU central processing unit
• the MMU when the MMU creates the page table mapping, the MMU adds a signature to each of the physical addresses in the mapping. Subsequently, when the device requests a translation from the MMU via address translation services (ATS), the MMU provides the signature or both the signature and the address to the device.
• the MMU device driver may send the virtual and physical addresses, including the signatures, to the device, e.g., so the device includes local page tables and does not need to request a translation from the MMU.
• a system may rely on mechanisms that prevent a device from spoofing part of the device's identity when generating a signature.
• a PCIe device identifier may be a 16-bit tuple called Bus/Device/Function (BDF) numbers and PCFs access control services (ACS) may prevent a device from changing the device's bus number.
• BDF Bus/Device/Function
• ACS PCFs access control services
• the MMU may use the device's bus number when generating a signature, e.g., by replacing a physical address provided to a device with a tuple: "Address, Hash(MMU secret value, physical address, read permission bit, write permission bit, execute permission bit, device bus number)".
• the MMU may use other bits or values as input to the hash function in addition to or instead of those above.
• the address and the signature together may be sixty -four bits.
• the MMU may use any appropriate method to generate the signature, including additional methods described below.
• addresses when addresses, e.g., PCIe addresses, can encode sixty -four bits to identify each address, and typical page allocation granularities are 4KB, 2MB, and 1GB, a system may use the fifty -three, forty -four, or thirty-five most significant or least significant bits of each page granularity for each respective page size to generate a signature.
• the MMU may provide 4KB-sized translations with fifty-three bits for a signature, e.g., so the MMU does not have to determine the original page translation size, or calculate three signatures, each with different low order bits masked out of the hash calculation.
• the MMU may add a page size indication in the response, e.g., the PCIe packet, and include that field in the hashed data, e.g., and use the page size to determine the number of bits used for the signature and the number of bits that represent the address.
• the device includes the signature for a particular physical address in each memory access request for that particular physical address, e.g., which normally contains the particular physical address and the device's BDF. For instance, during runtime, the device will send a particular physical address and the signature in every memory transaction for the particular physical address.
• the MMU e.g., in a PCIe root complex, can begin processing the request while verifying the signature in parallel, and can abort processing of the request if the MMU determines that the signature is invalid, e.g., and halt, reset, or both, the device the first time the MMU receives an invalid address from the device.
• the MMU may rotate the secret value to effectively destroy all usable knowledge the attacking device may have.
• the secret value may be a per-device secret value and the MMU may change only the secret value for the device that provided the MMU with an invalid address.
• the MMU may have two secret values for each device, e.g., for secret value rotation.
• the MMU may receive the secret value from an operating system or a hypervisor, e.g., hypervisor driver code.
• the MMU may generate the secret value internally, e.g., and never expose the secret value directly to software.
• the system may use any appropriate method to generate the secret value.
• FIG. 1 is an example of an environment 100 in which a memory management unit 102 generates and provides signatures for physical addresses to multiple devices A-B 104a-b.
• the memory management unit 102 may receive, at time TA, an address translation request from the device A 104a and use an address mapping 106 that associates virtual addresses, such as a virtual address included in the address translation request, with physical addresses.
• the memory management unit 102 determines a signature for the requested address at time TB.
• the memory management unit 102 may have previously generated the signature, e.g., when creating the address mapping 106 for the device A 104a and stored the signature in the address mapping 106, or may generate the signature in response to receipt of the address translation request.
• the memory management unit 102 may determine a signature type 108 for the requested address, e.g., using the virtual address in the address translation request, the corresponding physical address, the device A 104a from which the memory management unit 102 received the address translation request, functionality of the memory management unit 102 or the device A 104a from which the memory management unit 102 received the address translation request, or any other appropriate method including a combination of two or more of these.
• the memory management unit 102 may generate a signature for the physical address using a secret value, the physical address, and a read permission bit, a write permission bit, an execute permission bit, or a device bus number for the device A 104a.
• the secret value may be specific to the memory management unit 102 and, optionally, the device A 104a.
• the memory management unit 102 may reset the secret value and determine new signatures for all addresses for which devices have access.
• the memory management unit 102 may reset the secret value and determine new signatures for all addresses for which the particular device has access, and not the addresses for which other devices have access.
• the memory management unit 102 may use a secret value specific to both the memory management unit 102, and not other memory management units, and that is also specific to a particular device, e.g., the device A 104a.
• the particular device sends data access requests only to the memory management unit 102 and not another memory management unit that does not have the secret value used to determine a signature in the request.
• the memory management unit 102 may determine permissions for the device A 104a and use one or more of those permissions, e.g., read, write, or execute, to generate the signature. In some examples, the memory management unit 102 may use any number of mode or permission bits for the device A 104a, such as one or more of a cacheability bit, a cache level hint bit, a transaction class, or a virtual channel number. The memory management unit 102 may use a hash function, e.g., a strong cryptographic hash function, to generate the signature.
• a hash function e.g., a strong cryptographic hash function
• the memory management unit 102 may select a hash function to generate a signature and include the signature with the address 108a, e.g., appended or concatenated to the end or the beginning of the address, in a response provided to the device A 104a at time Tc so that the device A 104a will include the signature in any requests for access to the memory location identified by the physical address 108a. For instance, at time TD, the device A 104a would include the signature in a request for access to the memory location specified by the address 108a.
• the memory management unit 102 When the memory management unit 102 receives the address 108a from the device A 104a, at time TD, the memory management unit 102, at time TE, validates the address using the signature to ensure that the address, the signature, or both, have not be modified by the device A 104a, that another device does not use the address 108a, and that the requesting device A 104a should be allowed access to the corresponding memory location. For example, the memory management unit 102 may verify that only the device A 104a provides the address 108a to the memory management unit 102, and not the device B 104b, using the signature and the device bus number or the secret value for that particular device or both.
• the memory management unit 102 may validate the address, or the request, using the signature by generating a new signature for the address and comparing the new signature with the signature from the request to determine whether the signatures match. If the signatures match, the memory management unit 102 determines that the address, and the request, are valid. If the signatures do not match, the memory management unit 102 determines that the address, and the request, are not valid. The memory management unit 102 may perform any appropriate method to determine whether an address, and a corresponding request, are valid using the signature included in the request.
• the memory management unit 102 may service the request or cause the request to be serviced, e.g., by another component. For instance, the memory management unit 102 may allow the device A 104a access to a memory 110 that includes a location identified by the physical address in the memory access request.
• the memory management unit 102 determines that the address, the signature, or both have been modified, or that another device provided the address 108a to the memory management unit 102, e.g., the device B 104b, the memory management unit 102 does not service the request, e.g., and may reset or cause the resetting of one or both of the devices A-B 104a-b. For instance, when the address or the signature have been modified, the memory management unit 102, or another component in the environment 100 such as a PCIe root complex, resets the device A 104a.
• the memory management unit 102 may reset or cause the resetting of the device B 104b, the device A 104a, or both.
• the memory management unit 102 may change the secret value for the device.
• the memory management unit 102 may provide updated signatures to the device, e.g., to prevent the memory management unit 102 from receiving a request with a signature generated using a previous secret value and determining that the request is invalid. For instance, the memory management unit 102 may provide an updated page table to the device.
• the memory management unit 102 may use an advanced encryption standard (AES) process to generate the signature.
• AES advanced encryption standard
• the memory management unit 102 may use a Galois/Counter Mode (GCM) as a ten round AES-128 encryption process to generate the signature.
• the memory management unit may use a Galois Message Authentication Code (GMAC) process to generate the signature.
• GCM Galois/Counter Mode
• GMAC Galois Message Authentication Code
• the memory management unit 102 may use the physical address, the secret value for the device, the permissions of the requesting device, and the bus number of the requesting device as input to the AES-GCM process, e.g., in additional to any other appropriate input values.
• the memory management unit 102 may use a resulting tag, e.g., an authentication tag or a GMAC tag, as the signature, e.g., and discard the resultant cipher-text.
• the memory management unit 102 may generate a signature using a prefix of zero bits included in an address 108b at time TB. For instance, the memory management unit 102 may determine the number of leading zero bits included in the address 108b, encrypt the address 108b, e.g., using a secret value for the memory management unit 102 or the requesting device A 104a and possibly other values such as access bits or values as described above, and provide the encrypted address to the requesting device at time Tc.
• the memory management unit 102 decrypts the address, e.g., using the secret value and the other values, and determines whether the number of leading zero bits included in the decrypted address 108b is correct. If the number of leading zero bits is correct, the memory management unit 102 services the request at time TF. If the number of leading zero bits does not match the number of leading zero bits that were originally included in the address, e.g., and is incorrect, the memory management unit 102 does not service the request and may reset or halt, or cause the resetting or halting, of the device.
• the memory management unit 102 may use a block cipher to encrypt the address 108b.
• the memory management unit 102 may use a block cipher with an eight byte block size or AES in counter mode with the address 108b as input to the nonce generation.
• the memory management unit 102 uses a counter, e.g., a counter per secret value
• the memory management unit 102 includes the current value of the counter used in the encryption process in a response sent to the device A 104a, at time Tc, e.g., so that the memory management unit 102 can use the counter value during the decryption process.
• the memory management unit 102 may use the secret value as input to the block cipher.
• the memory management unit 102 may use any appropriate method to encrypt the address 108b and a corresponding method to decrypt the encrypted address.
• the memory management unit 102 may generate a signature for an address 108c, at time TB, and store the signature in another field of a response provided to the requesting device, e.g., the device A 104a at time Tc.
• the memory management unit 102 may store the signature in a response checksum, e.g., defined by PCIe to detect noise on electrical signaling wires.
• the memory management unit may generate a transaction layer packet digest for a response packet and include the physical address in the body of the response packet.
• the memory management unit may include the signature in the transaction layer packet digest, e.g., appended to the end of the digest as a link cyclic redundancy check (LCRC), and the requesting device receives the response packet.
• LCRC link cyclic redundancy check
• the requesting device A 104a When the requesting device A 104a needs to access the memory location specified by the physical address, the requesting device A 104a provides the response packet, with the transaction layer packet digest and the signature, to the memory management unit 102 at time TD, potentially routing the packet through one or more switches.
• the memory management unit 102 uses the signature, located in the checksum, to validate the address at time TE and ensure that the address, the signature, or both, have not been modified or corrupted and that the request should be serviced.
• the response packet may include setting data that indicates whether or not the checksum is present. For instance, a component or device may typically use the checksum to determine whether the response packet has been corrupted.
• any switches or other components that pass the packet from the requesting device A 104a to the memory management unit 102 are prevented from using the checksum to determine whether the packet has been corrupted, e.g., the setting data may indicate that the checksum is not present although the signature is stored in the checksum location.
• the memory management unit 102 or another component in the environment may use any appropriate method to ensure that intermediate components that pass a packet to the memory management unit 102 or from the memory management unit 102 to the requesting device A 104a do not use the signature in the checksum field to determine whether the packet has been corrupted.
• the memory management unit 102 may generate a checksum using a signature and the contents of a packet and store that checksum in the packet. The memory management unit 102 may then verify both the contents of the packet and the signature of the address using the checksum. For instance, when the memory management unit 102 receives a request for a memory access from the device A 104a, the memory management unit 102 may generate a signature using the address in the request and use the signature and the address to generate a new checksum. If the new checksum matches the checksum included in the request, the memory management unit 102 services the request, or has the request serviced, e.g., and has validated both the address and the integrity of the packet. If the new checksum does not match the checksum included in the request, the memory management unit 102 ensures that the request is not serviced.
• the memory management unit 102 determines that a memory access request for a physical address does not include a signature, the memory management unit 102 does not service the request. For instance, when a malicious device sends a physical address or a spoofed physical address, e.g., an invalid physical address, to the memory management unit 102 for access to memory corresponding to the physical address, and the memory management unit 102 determines that the malicious device did not include a signature in the request.
• the memory management unit 102 may reset the malicious device or halt the malicious device or cause the resetting or halting of the malicious device.
• the memory management unit 102 may determine that the address in the request is not a virtual address before determining whether the request includes a signature, e.g., as described in more detail below.
• the memory management unit 102 may provide the request to another device B 104b at time Tj.
• the request may be a read request or a write request.
• the memory management unit 102 may provide the signature of the requested address in the request sent to the other device B 104b.
• the forwarded request may include the signature for the requested address or the destination address, e.g., of the device A 104a.
• the memory management unit 102 may include the signature in the address field, in a header, or both, of the request.
• the other device B 104b determines data responsive to the request and provides a response to the memory management unit 102 at time Tk.
• the other device B 104b includes the signature from the request in the response, e.g., in the body, the header, or both.
• the other device B 104b may include the signature in a destination address of the response, in a checksum for the response, in a body of the response, or a combination of two or more of these, as described in more detail below.
• the memory management unit 102 receives the response and validates the response using the signature at time TL. For instance, the memory management unit 102 validates the response using one of the methods described above to uniquely connect the response, e.g., the destination address, to the requesting device A 104a. The memory management unit 102 may validate the destination address, e.g., of the requesting device A 104a, the address for the requested data, or both.
• the memory management unit 102 Upon validating the response, the memory management unit 102 provides the response to the device A 104a. When the memory management unit 102 determines that the response is not valid, the memory management unit 102 does not provide the response to a destination identified in the response. The memory management unit 102 might not provide the response to the destination, e.g., may destroy the response, to prevent unsolicited responses from being sent to devices, e.g., as part of a denial of service attack.
• the memory management unit 102 may provide a request to the other device B 104b at time Tj that includes a signature for both the requesting device A 104a and the other device B 104b that will service the request. For instance, the memory management unit 102 may determine two signatures, one for each of the devices, using the device's corresponding secret value, corresponding bus number, and the physical address of the memory location to be accessed.
• the other device B 104b will then respond to the request with data responsive to the request and both signatures, either in the body of the response, in a header, or both, e.g., one signature in the body and another signature in the header.
• the memory management unit 102 uses both signatures to validate the response and only provides the response to the requesting device in response to validation using both signatures. This may prevent the other device B 104b from sending "responses" to requests that were never provided to the other device B 104b.
• devices when devices may communicate in a peer-to- peer environment, e.g., without a memory management unit monitoring the
• each of the devices may generate signatures and perform validation similar to the validation described above.
• the requesting device A 104a may request an address translation for a virtual address from the other device B 104b and receive a signature, with or without an address, in response.
• the requesting device A 104a may then send a request for access to a corresponding physical memory location to the other device B 104b and include the signature with the request.
• the other device B 104b then validates the request using the signature and only responds to the request in response to determining that the request is valid.
• a request sent from the requesting device A 104a may include two signatures, one of which the other device B 104b uses to validate the request and the other which the requesting device A 104a uses to validate the response.
• the first signature may be included in the address field of the request and the other device B 104b may use the first signature to determine whether the request is valid.
• the second signature may be included in a header of the request such that the other device B 104b includes the second signature in the response and the requesting device A 104a determines whether the response is valid using the second signature.
• the device A 104a receives a "response" that does not include a signature, e.g., in the header, the device A 104a rejects the response, e.g., by discarding the data.
• FIG. 2 is a flow diagram of a process 200 for processing requests.
• the process 200 can be used by the memory management unit 102 from the environment 100.
• a system receives multiple requests, each for a physical address (202).
• a memory management unit, a switch, or a root complex receive the requests.
• the system determines whether the request includes an unknown address (204). For example, when a component such as a switch chip receives the request, the switch chip may determine that the switch chip does not recognize the address and should forward the address to a memory management unit, e.g., included in the switch chip or another component such as a root complex.
• a memory management unit e.g., included in the switch chip or another component such as a root complex.
• the switch chip when the switch chip is included in a motherboard, the switch chip may receive a request that includes an address from a device, e.g., a video card. The switch chip may determine that it does not know a destination for the address included in the request, e.g., the address is a virtual address or includes a signature, and that the address is unknown. The switch chip may then determine whether or not to forward the request to a memory management unit for processing, e.g., translation from a virtual address to a physical address or validation using a signature included in the address.
• a memory management unit for processing, e.g., translation from a virtual address to a physical address or validation using a signature included in the address.
• the system processes the request (206). For instance, the component services the request, e.g., by forwarding the request to another device or component which may have data responsive to the request.
• the system sends the request to a memory management unit (208).
• the switch chip sends the request to the memory management unit because the switch chip is unable to determine the destination of the request using the destination address in the request.
• the system determines whether the request includes a virtual address
• an address type field indicates that the request includes a virtual address or a physical address.
• an address type field may have a first encoding for non-translated virtual address, a second encoding for a translation request, e.g., that includes a virtual address, and a third encoding for a translated address, e.g., that includes a physical address.
• the system determines a physical address using the virtual address (212). For example, the component uses a mapping that associates virtual addresses with physical addresses, e.g., a page table, to determine the physical address.
• the system generates a signature for the physical address (214).
• the component uses one of the methods described in this specification to generate the signature and stores the signature in an address field, e.g., body, of a response, a header of the response, or both.
• the component may use an identifier of the device to determine a secret value to use when generating the signature.
• the component may use a general secret value, e.g., specific to the component, that is not specific to any particular device.
• the system may generate a hash using two or more of the physical address, a secret value for the component, a secret value for the device, an identifier for the device, e.g., a device bus number, a read permission bit, a write permission bit, an execute permission bit, or other appropriate values associated with either the component or the device or both.
• the system may use all or a portion of the hash as the signature, e.g., a predetermined number of the most significant bits or the least significant bits.
• the identifier for the device may be particular to the function of the device.
• the identifier for the device may be one or more of the bus, device, or function numbers for the device, e.g., as specified by PCIe.
• the component may generate a signature for a physical address, concatenate the signature to the physical address, and encrypt the concatenated signature and physical address.
• the component may place the encrypted concatenated signature and physical address in the response.
• the component may encrypt the physical address, generate a signature for the encrypted physical address, and place the encrypted physical address, or the plaintext version of the physical address, in a response with the signature.
• the physical address and the signature of the encrypted physical address may be in the same field of the response, e.g., the body, or may be in different fields, e.g., the physical address, encrypted or plaintext, may be in the body and the signature may be in a header of the response.
• the system provides a response that includes the signature (216).
• the component provides the response to the requesting device.
• the response may include a plaintext physical address with a signature, e.g., both in the body field of the response or with the signature in a header.
• the response may include an encrypted physical address with a signature, e.g., both in the body field of the response or with the signature in a header.
• the response may include an encrypted physical address in the body of the response such that a decrypted version of the physical address includes a known good value in a predetermined portion of the physical address, e.g., the upper N most bits of the plaintext address must all be zeros. In some examples, N is thirty -two bits.
• the system determines whether the physical address for the request is validated using a corresponding signature (218). For instance, the component generates a signature for the physical address and compares the newly generated signature with a signature included in the request to determine whether the two signatures are the same.
• the component may use an identifier of the requesting device, included in the request, to determine a secret value for the device, or the component may use a general secret value when the component does not have per-device secret values.
• the component then generates a signature for the physical address using the same method the component previously used to generate the signature included in the request, e.g., using the secret value, and then compares the newly generated signature with the signature included in the request to determine whether or not the physical address, and the request, are validated.
• the component may determine that the address is validated by decrypting an encrypted physical address included in the request and comparing a number of consecutive zeros in the decrypted address, e.g., at the beginning or end of the physical address, with a known value, e.g., that specifies the number of consecutive zeros that should be in the address. If the number of consecutive zeros in the decrypted address is the same as the known value, the component determines that the signature and the request are validated. If the number of consecutive zeros in the decrypted address is not the same as the known value, the component determines that the signature and the request are not validated. [0073] In response to determining that the physical address for the request is validated using the corresponding signature, the system services the request (220). For example, the component forwards the request to a destination device or component.
• a known value e.g., that specifies the number of consecutive zeros that should be in the address.
• the system does not service the request (222). For instance, the component may deny the request, reset or halt the device that sent the request to the component, log an error that identifies the request, e.g., in an error log, change a secret value for the requesting device, disable the requesting device's access to a memory, or any combination of two or more of these.
• a switch chip or a root complex disable the requesting device's access to a memory in response to a message from a memory management unit, e.g., when the memory management unit determines that the request should not be serviced.
• the system may generate a signature for the physical address, e.g., perform step 214, before receiving a request for a translation of a virtual address to a physical address, e.g., step 202.
• the process 200 can include additional steps, fewer steps, or some of the steps can be divided into multiple steps.
• the component may perform steps 202, 210 and 218 through 222 without performing the remaining steps.
• the component may perform steps 202 and 210 through 216 without performing the remaining steps.
• the process 200 might not include steps 204 through 208.
• a first component e.g., a switch chip
• the first component may determine that each of the requests includes an unknown address, e.g., a virtual address or an address with a signature, and then provide the request to the second component, e.g., a memory management unit.
• a first component may perform steps 202 and 204 and, optionally for some of the requests perform step 206, and then forward requests not processed using step 206 to a second component for processing.
• the first component and the second component may communicate to service or not service the request, e.g., when the request is denied or a requesting device is halted.
• the memory management unit may convert a request that includes a signature into a "standard" request, e.g., without a signature, before sending the request to another device or component for processing. For instance, after determining that a request is validated, the memory management unit may convert the request to include only the physical address and no signature and forward the converted request to another device or component, e.g., a root complex, for processing.
• a memory management unit converts the request to a standard request without a signature before forwarding the request to a destination device no matter where the memory management unit is located in a system, e.g., whether or not the memory management unit is part of a switch chip, a root complex, or another component.
• the memory management unit may mark a packet that includes the request as "address translated" before sending the request to another device, e.g., a root complex.
• a memory management unit may balance the probability a device may successfully determine a signature on a first attempt with the length of the signature, e.g., a shorter signature. For instance, if the memory management
• the device uses a cryptographic process and the signature is N bits long, then the device has a ⁇ probability of guessing a valid signature for an address or permissions for which the device should not be allowed access depending on the cryptographic process used.
• the device may store valid addresses and valid signatures and have some form of known plaintext attack available using the valid addresses and valid signatures.
• the memory management unit may truncate the address, e.g., by removing unnecessary bits, such as zeros. For instance, when the memory management unit uses sixty-four bit addresses, the memory management unit may create a sixteen bit signature, e.g., by removing the leading sixteen bits from a corresponding address, and use forty-eight bits for the address. When receiving a request for access to a memory location, the memory management unit may generate a new signature using the forty-eight bits of the address and compare the new signature with the signature included with the address to determine whether the two signatures match. If the two signatures match, the memory management unit may process the request. If the two signatures do not match, the memory management unit does not process the request, e.g., and may reset, halt, or both, the requesting device.
• the component that performs the routing may perform the validation.
• the component that performs the routing may forward the unknown address to a memory management unit, e.g., a PCIe root complex that includes the memory management unit, for processing.
• an environment may include a configurable partition between bits for an address and bits for a signature such that the configurable partition may be adjusted to achieve a desired probability of a device guessing a valid signature. For instance, in an environment that includes 1TB of random access memory (RAM), a memory management unit may use twenty-four bits for the signature. The memory management unit may adjust the size of the signature based on the size of the RAM or another memory in the environment. For example, the memory management unit may determine the size of the signature when a computer that includes the memory management unit is initially turned on.
• RAM random access memory
• a memory management unit generates a signature upon receiving a request for a translation of a virtual address to a corresponding physical address.
• a memory management unit generates signatures for all physical addresses when providing a device with corresponding virtual addresses or in response to receiving identification of the virtual addresses for the device.
• the memory management unit may store the signatures in an address mapping.
• the memory management unit may provide the address mapping to the device and include the signatures in the address field of the address mapping.
• a memory management unit provides a single signature to a device, e.g., in response to a request for a corresponding physical address. In some implementations, a memory management unit provides multiple signatures to a device at a time, e.g., for a block of physical addresses or for all physical addresses to which the device has access. The memory management unit may provide multiple signatures to a device in response to detecting the device. [0085] In some implementations, a memory management unit may provide only a signature to a requesting device in response to an address translation request, e.g., when the address is encrypted. In some implementations, a memory management unit may provide both a signature and an address to a requesting device in response to an address translation request.
• the memory management unit may use two or more of the methods described above to generate a signature. For instance, the memory management unit may store part of a signature in an address field of a packet and part of the signature in a header field, e.g., a checksum field. In some examples, the memory management unit may determine a number of leading zeros, encrypt the address, determine a signature of the encrypted address, and store the signature in a header field, e.g., a checksum field, of a packet that includes the encrypted address in the body.
• a header field e.g., a checksum field
• the memory management unit may generate a new signature, compare the new signature with the signature included in the access request, decrypt the address, determine the number of leading zeros in the decrypted address, and only service the request when both the number of leading zeros in the decrypted address is correct and the new signature and the signature included in the access request are the same.
• a component other than a memory management unit, or an input/output memory management unit may generate and validate signatures or perform some of the steps above.
• a switch, a root complex, or a central processing unit may generate and validate signatures.
• a single type of component e.g., a memory management unit, may generate signatures and multiple different types of components may validate the signatures, e.g., both memory management units and switches.
• a physical system may include multiple memory managements units and other components that generate and validate addresses.
• particular components may generate, validate, or both, addresses for particular devices.
• components may share secret values for a particular device to allow multiple components to generate, validate, or both, signatures for the particular device.
• a component may include multiple keys for a single device. For instance, the component may use different keys to generate and validate different addresses for the device. When a system removes access for the device to some of the addresses, the component removes or changes the key for those addresses, potentially invalidating other addresses as well. To minimize the number of addresses which are invalidated, the component uses multiple keys so that only the addresses with the same key are invalidated, and may need to be re-signed if the device still has access to some of those addresses, while addresses signed and validated with other keys do not need to be re-signed.
• a device when a device is a graphics processing unit or another device that uses a large memory allocation, the device may have a large number of pages, a portion of which are persistent and another portion of which rapidly churn and invalidate quickly. For instance, the device may have persistent access to the portion because of garbage collection.
• a component may use a first key for a first subset of addresses, e.g., to which the device will continue to have access, and a second key for a second subset of addresses, e.g., that invalidate quickly. The component may then change the second key when the device no longer has access to one or more of the addresses to prevent the device from accessing corresponding memory locations identified by the addresses in the second subset of addresses.
• the component may use more than two keys to enable further refinement of key rotation.
• the component may use a first key, or two first keys, for a first subset of addresses for which the device will continue to have access, and ten second keys for a second subset of addresses for which the device will only have temporary access or for which the contents of the corresponding memory locations quickly change as the memory is overwritten by other components or devices.
• the component may rotate the second key or any of the second keys more quickly than the first key or the first keys.
• the component may include an index identifier in a signature to determine which key to use for a particular address.
• the component may keep the keys in an array and include the index identifier in a signature when generating a signature, e.g., at the beginning or the end of the signature.
• the component determines the index identifier from the signature and uses the index identifier to determine a location in the array that includes the key to use when validating the memory access request, e.g., and the address included in the memory access request.
• the component may use an identifier in a page table, e.g., a page table entry, that indicates which key to use for a particular address.
• the component may set the identifier when creating a signature for an address and use the identifier to determine which key to use when validating the address.
• the component may use the identifier when using a single key for each device, e.g., to determine which key to use for each device, or when using multiple keys for one or more devices, or both.
• a component may use an index instead of multiple keys for a single device to allow invalidation of a subset of addresses to which a device has access while allowing the device to continue to access another subset of addresses.
• a portion of a signature may be an index which the component uses to determine whether the device has access to a corresponding memory location.
• the component receives a memory access request, the component determines whether a corresponding location in a buffer contains a predetermined value. If the corresponding location in the buffer contains the predetermined value, and the component validates the signature, the component allows the device access to the corresponding memory location. If the corresponding location in the buffer does not contain the predetermined value, or the component does not validate the signature, the component does not service the memory access request, e.g., the component prevents the device from accessing the corresponding memory location.
• the component may reserve a first set of indices for addresses to pages for which the device will continue to have access and a second set of indices for addresses to pages for which invalidate quickly for the device.
• a number of indices in the second set of indices may be greater than a number of indices in the first set of indices.
• the component may use a bit vector with one bit per index value.
• the component sets a value of the location of the particular index in the bit vector to a predetermined value, e.g., one.
• a predetermined value e.g., one.
• the component generates a signature using the key for the device, the component includes the particular index value in the signature, e.g., at the beginning or the end of the signature.
• the component determines whether a location in the bit vector that corresponds to the particular index value, retrieved from the signature included in the memory access request, is the predetermined value or not.
• the component When the location in the bit vector is the predetermined value and the component validates the memory access request, the component allows the memory access request to be serviced. When the location in the bit vector is not the predetermined value or the component does not validate the memory access request, the component prevents the memory access request from being serviced.
• the component may use both multiple keys for a single device and an index to determine whether or not the single device should have access to a particular memory location. For instance, the component may use a first bit in a page table entry to indicate which key was used to generate a signature for a corresponding address and a second bit in the page table to indicate which index was used to allow the device access to corresponding memory locations.
• a component may invalidate an address, e.g., for a memory location to which the device no longer has access, by sending an ATS invalidation message to the device, or any other appropriate type of message.
• a component may invalidate an address to change a key, an index, or both, that are associated with the address.
• the component may change the key, the index value, or both.
• the component sends an invalidation message to the device for the addresses, e.g., a second address, generates a new signature for the addresses, if necessary, or changes the index to a new index value, or both, and sends another message to the device with the new signature, the new index value, or both.
• the component validates the access request, assuming that the new key, the new index, or both, are still valid.
• the component may assign the other addresses to a second subset of addresses which may or may not initially include other addresses, e.g., the component may assign the second address to a key or an index, or both, that are already used for a third address or that is not yet being used for any addresses.
• Embodiments of the subject matter and the functional operations described in this specification can be implemented in digital electronic circuitry, in tangibly- embodied computer software or firmware, in computer hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them.
• Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible non-transitory program carrier for execution by, or to control the operation of, data processing apparatus.
• the program instructions can be encoded on an artificially-generated propagated signal, e.g., a machine-generated electrical, optical, or electromagnetic signal, that is generated to encode information for transmission to suitable receiver apparatus for execution by a data processing apparatus.
• the computer storage medium can be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or a combination of one or more of them.
• data processing apparatus refers to data processing hardware and encompasses all kinds of apparatus, devices, and machines for processing data, including by way of example a programmable processor, a computer, or multiple processors or computers.
• the apparatus can also be or further include special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC
• the apparatus can optionally include, in addition to hardware, code that creates an execution environment for computer programs, e.g., code that constitutes processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of them.
• code that creates an execution environment for computer programs e.g., code that constitutes processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of them.
• a computer program which may also be referred to or described as a program, software, a software application, a module, a software module, a script, or code, can be written in any form of programming language, including compiled or interpreted languages, or declarative or procedural languages, and it can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.
• a computer program may, but need not, correspond to a file in a file system.
• a program can be stored in a portion of a file that holds other programs or data, e.g., one or more scripts stored in a markup language document, in a single file dedicated to the program in question, or in multiple coordinated files, e.g., files that store one or more modules, sub-programs, or portions of code.
• a computer program can be deployed to be executed on one computer or on multiple computers that are located at one site or distributed across multiple sites and
• the processes and logic flows described in this specification can be performed by one or more programmable computers executing one or more computer programs to perform functions by operating on input data and generating output.
• the processes and logic flows can also be performed by, and apparatus can also be implemented as, special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit).
• Computers suitable for the execution of a computer program include, by way of example, general or special purpose microprocessors or both, or any other kind of central processing unit.
• a central processing unit will receive instructions and data from a read-only memory or a random access memory or both.
• the essential elements of a computer are a central processing unit for performing or executing instructions and one or more memory devices for storing instructions and data.
• a computer will also include, or be operatively coupled to receive data from or transfer data to, or both, one or more mass storage devices for storing data, e.g., magnetic, magneto-optical disks, or optical disks.
• mass storage devices for storing data
• a computer need not have such devices.
• a computer can be embedded in another device, e.g., a mobile telephone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a Global Positioning System (GPS) receiver, or a portable storage device, e.g., a universal serial bus (USB) flash drive, to name just a few.
• PDA personal digital assistant
• GPS Global Positioning System
• USB universal serial bus
• Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media and memory devices, including by way of example semiconductor memory devices, e.g., EPROM, EEPROM, and flash memory devices; magnetic disks, e.g., internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks.
• semiconductor memory devices e.g., EPROM, EEPROM, and flash memory devices
• magnetic disks e.g., internal hard disks or removable disks
• magneto-optical disks e.g., CD-ROM and DVD-ROM disks.
• the processor and the memory can be supplemented by, or incorporated in, special purpose logic circuitry.
• a computer having a display device, e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, for displaying information to the user and a keyboard and a pointing device, e.g., a mouse or a trackball, by which the user can provide input to the computer.
• a display device e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor
• a keyboard and a pointing device e.g., a mouse or a trackball
• Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback, e.g., visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including acoustic, speech, or tactile input.
• a computer can interact with a user by sending documents to and receiving documents from a device that is used by the user; for example, by sending web pages to
• FIG. 3 shows a schematic diagram of a generic computer system 300.
• the system 300 can be used for the operations described in association with any of the computer-implemented methods described previously, according to one implementation.
• the system 300 includes a processor 310, a memory 320, a storage device 330, and an input/output device 340. Each of the components 310, 320, 330, and 340 are interconnected using a system bus 350.
• the processor 310 is capable of processing instructions for execution within the system 300.
• the processor 310 is a single-threaded processor.
• the processor 310 is a multi-threaded processor.
• the processor 310 is capable of processing instructions stored in the memory 320 or on the storage device 330 to display graphical information for a user interface on the input/output device 340.
• the memory 320 stores information within the system 300.
• the memory 320 is a computer-readable medium. In one
• the memory 320 is a volatile memory unit. In another implementation, the memory 320 is a non-volatile memory unit.
• the storage device 330 is capable of providing mass storage for the system
• the storage device 330 is a computer-readable medium. In various different implementations, the storage device 330 may be a floppy disk device, a hard disk device, an optical disk device, or a tape device.
• the input/output device 340 provides input/output operations for the system 300.
• the input/output device 340 includes a keyboard and/or pointing device.
• the input/output device 340 includes a display unit for displaying graphical user interfaces.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Theoretical Computer Science (AREA)
• General Engineering & Computer Science (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Computer Hardware Design (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computing Systems (AREA)
• Software Systems (AREA)
• Power Engineering (AREA)
• Storage Device Security (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Information Transfer Between Computers (AREA)

Priority Applications (9)

Applications Claiming Priority (4)

Publications (1)

Family

ID=56027260

Family Applications (1)

Country Status (10)

Cited By (3)

Families Citing this family (34)

Citations (2)

Family Cites Families (19)

• 2015
  • 2015-09-28 US US14/867,250 patent/US9749319B2/en active Active
• 2016
  • 2016-05-13 GB GB1715263.8A patent/GB2553228C/en active Active
  • 2016-05-13 DK DK16724257.7T patent/DK3298498T3/da active
  • 2016-05-13 TW TW108142552A patent/TWI726496B/zh active
  • 2016-05-13 EP EP16724257.7A patent/EP3298498B1/en active Active
  • 2016-05-13 DE DE202016107447.9U patent/DE202016107447U1/de active Active
  • 2016-05-13 CN CN201680019968.6A patent/CN107438850B/zh active Active
  • 2016-05-13 DK DK18212413.1T patent/DK3489835T3/da active
  • 2016-05-13 EP EP18212413.1A patent/EP3489835B1/en active Active
  • 2016-05-13 FI FIEP18212413.1T patent/FI3489835T3/fi active
  • 2016-05-13 CN CN201910110123.3A patent/CN110134619B/zh active Active
  • 2016-05-13 TW TW105114972A patent/TWI596475B/zh active
  • 2016-05-13 DE DE112016002285.9T patent/DE112016002285T5/de not_active Withdrawn
  • 2016-05-13 TW TW106123863A patent/TWI720229B/zh active
  • 2016-05-13 EP EP20184432.1A patent/EP3739458A1/en active Pending
  • 2016-05-13 WO PCT/US2016/032429 patent/WO2016187029A1/en active Application Filing
  • 2016-05-13 GB GB1813182.1A patent/GB2574280B/en active Active
• 2017
  • 2017-07-27 US US15/661,632 patent/US10027666B2/en active Active
• 2018
  • 2018-04-19 HK HK18105057.9A patent/HK1245918B/zh unknown
  • 2018-07-10 US US16/031,525 patent/US10326763B2/en active Active
• 2019
  • 2019-05-03 US US16/402,561 patent/US10666652B2/en active Active
• 2020
  • 2020-05-08 US US16/869,947 patent/US11223620B2/en active Active
• 2022
  • 2022-01-10 US US17/572,066 patent/US11627131B2/en active Active
• 2023
  • 2023-03-09 US US18/181,432 patent/US11870780B2/en active Active

Patent Citations (2)

Also Published As

Similar Documents

Legal Events